How can a small team use MITRE ATT&CK to find gaps in its detection?
Start from the attacks you are most likely to face, not from the whole matrix. Take two or three recent public advisories that fit your sector, for example a CISA advisory on a ransomware group, list the techniques they name, and for each ask: would we prevent it, would we see it, and where would we see it? Mark the answer per technique: endpoint, identity, e-mail, network or nothing. The gaps that matter are steps where every answer is nothing. Then test one or two with a simple exercise rather than trusting the table. Do not aim for full coverage; aim for at least one reliable signal in each stage of a typical attack. NetSenX names the ATT&CK technique on its alerts where one applies and shows in a coverage view which techniques your enabled detections address, which fills in the network column of this exercise.